Cybersecurity

The broader context — why being small makes you vulnerable. A small business does not mean a small risk.

I remember that my father, who spent his whole life repairing cars in a neighbourhood garage, always used to say that a thief doesn't break into houses with big dogs — he breaks into the ones with a low fence and the lights off. He was not a man given to elaborate metaphors; he was a man of mechanics, of tangible things, of direct cause and effect. If something wasn't working, you found the cause, you fixed it, you moved on. He knew nothing about cybersecurity, had never heard of Business Email Compromise, had never read any FTC report about the scams battering SMEs across America and Europe alike. But he had understood something fundamental about the nature of vulnerability: that nobody attacks you where you are strong and prepared — they attack you where you are distracted, rushed, tired, and above all, where you believe you are too small to matter.

I run a small firm. Based in Botoșani, in north-eastern Romania, a region that Bucharest systematically ignores and that investment maps pass through without stopping. I build websites for town halls, hospitals, schools, and private companies that have come to understand that existing on the internet is no longer a luxury — it is a condition of survival. I have clients who ask for quotes on European-funded projects and clients who negotiate the price of an SSL certificate with me as if they were haggling over tomatoes at a market. And within this entire spectrum of daily reality — invoices, contracts, emails, deadlines, deliverables, DNSC [National Directorate of Cyber Security] vulnerability reports, GDPR compliance, NIS2, Law 232 — I have discovered, particularly over the last two years, that I am not merely a provider of digital services. I am also a target.

Not a large, spectacular target of the kind that makes the news. Not a company with hundreds of employees, not a bank, not an operator of critical infrastructure. I am precisely the type of target that digital fraudsters prefer precisely because it is small, precisely because it has no IT department with twenty people and a well-paid CISO, precisely because behind the firm there is a single person who, at ten o'clock in the evening, is answering emails whilst his teenage son asks him to watch something together on YouTube, and the cat — Gri, a grey cat with the temperament of a Stoic philosopher — sleeps on the laptop keyboard with an indifference that is almost insulting towards the problems of the digital world.

The show was something else entirely. About betrayal without direct lying, about promises that never lie, and about the architecture of premeditated baseness. An informal presentation in relational hygiene. Not self-defence. Not cynicism. Hygiene. The distinction matters, and I repeat it because it is worth repeating: hygiene does not mean refusing to shake anyone's hand. It means knowing when to wash your hands ... if you're wondering what any of this has to do with Cybersecurity — I'll grant you, it's a touch melodramatic ... even if it stays on the level of metaphor.

"You were never told an untruth. You were told the truth in the order in which it could be used." — a thought that visits you at three in the morning, long after everything is over

Introduction — Or What a Play Looks Like When You Don't Know You're an Actor

The morning began early, with the smell of coffee I had made in a hurry and with my mother already in the hallway, already dressed, already holding her bag, a full twenty minutes before there was any need. She is eighty-two years old, and this punctuality of hers in the face of any commitment — the doctor, church, a nephew's wedding, a simple walk — remains unchanged, like a reflex from another era, from a generation that considered being on time the minimum form of respect for another person but in her haste she forgot the apartment door was open (we found out when we got back because her neighbors were visiting for coffee in the morning, and she was away from home). I drank my coffee standing up, watching her sitting on the hallway chair, staring straight ahead at the door with a focus I find difficult to describe as either courage or habit acquired from living with what cannot be changed.

The Senate has voted. Seventy-nine in favour, twenty-two abstentions, a single vote against. If you've ever watched Romanian digital legislation inch its way through parliament, you'll know how unusual a result like this is. Normally things drag on, get amended, get postponed. This time, they didn't.

The bill that prohibits commercial email addresses — Gmail, Yahoo, personal Outlook accounts — from official communications by public institutions is now before the Chamber of Deputies. Promulgation follows. A twelve-month transition period follows. For the first time in Romania, a national system of official, verifiable email, under Romanian jurisdiction, follows.

If you build and maintain websites for town halls, schools, hospitals, or county councils, this law changes the landscape you work in. Not tomorrow. But soon.

The Numbers That Explain Why a Law Was Necessary

67% of Romanian public institutions use commercial email addresses for official communications. Two thirds of them. We're not talking about a marginal habit confined to a handful of small municipalities in remote corners of the country. We're talking about the normal operating procedure of Romanian public administration.

From a web and SEO perspective, it's a pattern I've seen repeated across every project involving public institutions: the absence of basic digital infrastructure. A shiny new website, built with European funds or local budget money, and yet the contact email is still This email address is being protected from spambots. You need JavaScript enabled to view it.. An address created ten years ago, the password known by three people or by no one, the account accessed from computers running outdated antivirus software.

The law didn't appear out of nowhere. It appeared because this is exactly what things look like on the ground.

Last Saturday, my mother rang to tell me she'd received an advert on her phone — something about blood pressure medication. She hadn't searched for anything. She hadn't typed a word. But two days earlier she'd been on the phone to her sister, talking about the family doctor and a new prescription.

"The phone was listening to me," she told me, quite certain of it.

Perhaps it was. Perhaps not — the technical explanation is more nuanced than that. The subject itself is hardly new; this kind of unease has been circulating for at least five years. But her reaction says something essential: instinctively, we feel that we have lost control over what the world knows about us. And, by and large, we are right.

What We Mean by Anonymity, and Why It Matters

Anonymity is not a technical concept reserved for hackers or political dissidents. It is a fundamental psychological experience — the sense that you can exist, think, and act without every gesture being recorded, interpreted, and stored somewhere.

John Suler, professor of psychology at Rider University and author of The Psychology of Cyberspace, describes this need with clinical precision: each of us carries a public self and a private self simultaneously. The public self navigates social relationships — family, colleagues, neighbours. The private self is the interior space of reflection, of unspoken thoughts, of identity still being formed. Without that space, our sense of wellbeing begins to unravel.

This isn't paranoia. It's psychological hygiene.

The trouble is that this space is being systematically eroded, day by day, through mechanisms we have accepted without fully understanding them.